librelp 1.13.0 released

librelp 1.13.0 [download]
sha256sum: 58e976e31795d7309cf2d9f37fdc93522daa4a322f5012d7879fed9ebfa40068

We are pleased to announce the availability of librelp 1.13.0.

This release introduces new application lifecycle callbacks, significant stability and resource cleanup improvements across TLS engines (OpenSSL and GnuTLS), testbench portability fixes, and documentation updates.

For more details, please take a look at the changelog below.

———————————————————————

Version 1.13.0 – 2026-08-18

• API: add server-session lifecycle callbacks
  Applications can now register callbacks for session open, close, and
  failed-open events. Callback teardown semantics and the accompanying
  regression coverage have been corrected as well.
• relp: avoid spurious errors while tearing down half-open clients
  Do not attempt a graceful RELP close when a client has not reached a state
  in which it can send one, avoiding an extra wait-state error during
  shutdown.
  Thanks to Copilot for the initial patch.
• OpenSSL: apply client TLS configuration commands before creating SSL objects
  tlsConfigCmd settings such as Groups now take effect on client connections,
  including on OpenSSL 3.x.
  Thanks to Cropi for the patch.
• documentation: convert the RELP specification to Markdown and correct
  follow-up typos.
  Thanks to sapunyangkut for the conversion.
• OpenSSL: clean up connections whose TLS setup fails.
• build: initialize the epoll descriptor before platform-specific setup.
• OpenSSL: fix socket ownership during TLS teardown
  OpenSSL BIOs no longer close sockets owned by librelp, preventing a
  descriptor that has already been reused from being closed during TLS
  cleanup. Error cleanup after accepting a connection now also has a single,
  explicit socket owner.
  Thanks to Renaud Métrich for the original work and finding in #292; this
  was accidentally merged via a different PR.
• TLS: make teardown safe for both supported TLS libraries
  GnuTLS now sends close_notify while the transport is still available and
  releases session, credential, and DH resources even when setup fails
  partway through. OpenSSL cleanup correctly handles partially initialized
  TLS state. Regression tests cover the affected ownership and lifecycle
  paths.
• OpenSSL: prevent a busy loop after successful TLS I/O
  Clear stale retry state after SSL_read() or SSL_write() succeeds following
  WANT_READ or WANT_WRITE, so the event loop is not left waiting for the
  wrong readiness direction.
  closes: https://github.com/rsyslog/librelp/issues/296
• OpenSSL: release peer certificates after use
  Prevent a peer-certificate memory leak during certificate verification.
• build: fix compiler attribute placement
  Thanks to zhangzikang01 for the patch.
• testbench: make TLS ownership and lifecycle regression tests portable
  The static white-box fixtures now detect their socket, realtime, and pthread
  link dependencies, support OpenSSL 1.0.2, and are skipped where Solaris
  linker wrapping is unavailable.
• CI: restrict Codecov uploads to the canonical repository.
• development: ignore local machine-specific Codex agent notes.